chore: merge probe-engine into probe-cli (#201)

This is how I did it:

1. `git clone https://github.com/ooni/probe-engine internal/engine`

2. ```
(cd internal/engine && git describe --tags)
v0.23.0
```

3. `nvim go.mod` (merging `go.mod` with `internal/engine/go.mod`

4. `rm -rf internal/.git internal/engine/go.{mod,sum}`

5. `git add internal/engine`

6. `find . -type f -name \*.go -exec sed -i 's@/ooni/probe-engine@/ooni/probe-cli/v3/internal/engine@g' {} \;`

7. `go build ./...` (passes)

8. `go test -race ./...` (temporary failure on RiseupVPN)

9. `go mod tidy`

10. this commit message

Once this piece of work is done, we can build a new version of `ooniprobe` that
is using `internal/engine` directly. We need to do more work to ensure all the
other functionality in `probe-engine` (e.g. making mobile packages) are still WAI.

Part of https://github.com/ooni/probe/issues/1335

internal/engine/legacy/netx/dialer_test.go

@@ -0,0 +1,115 @@
+package netx_test
+
+import (
+	"crypto/x509"
+	"errors"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx"
+)
+
+func TestDialerDial(t *testing.T) {
+	dialer := netx.NewDialer()
+	conn, err := dialer.Dial("tcp", "www.google.com:80")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestDialerDialWithCustomResolver(t *testing.T) {
+	dialer := netx.NewDialer()
+	resolver, err := netx.NewResolver("tcp", "1.1.1.1:53")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dialer.SetResolver(resolver)
+	conn, err := dialer.Dial("tcp", "www.google.com:80")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestDialerDialWithConfigureDNS(t *testing.T) {
+	dialer := netx.NewDialer()
+	err := dialer.ConfigureDNS("tcp", "1.1.1.1:53")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn, err := dialer.Dial("tcp", "www.google.com:80")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestDialerDialTLS(t *testing.T) {
+	dialer := netx.NewDialer()
+	conn, err := dialer.DialTLS("tcp", "www.google.com:443")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestDialerDialTLSForceSkipVerify(t *testing.T) {
+	dialer := netx.NewDialer()
+	dialer.ForceSkipVerify()
+	conn, err := dialer.DialTLS("tcp", "self-signed.badssl.com:443")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.Close()
+}
+
+func TestDialerSetCABundleNonexisting(t *testing.T) {
+	dialer := netx.NewDialer()
+	err := dialer.SetCABundle("testdata/cacert-nonexistent.pem")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+}
+
+func TestDialerSetCABundleInvalid(t *testing.T) {
+	dialer := netx.NewDialer()
+	err := dialer.SetCABundle("testdata/cacert-invalid.pem")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+}
+
+func TestDialerSetCABundleWAI(t *testing.T) {
+	dialer := netx.NewDialer()
+	err := dialer.SetCABundle("testdata/cacert.pem")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn, err := dialer.DialTLS("tcp", "www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	var target x509.UnknownAuthorityError
+	if errors.As(err, &target) == false {
+		t.Fatal("not the error we expected")
+	}
+	if conn != nil {
+		t.Fatal("expected a nil conn here")
+	}
+}
+
+func TestDialerForceSpecificSNI(t *testing.T) {
+	dialer := netx.NewDialer()
+	err := dialer.ForceSpecificSNI("www.facebook.com")
+	conn, err := dialer.DialTLS("tcp", "www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	var target x509.HostnameError
+	if errors.As(err, &target) == false {
+		t.Fatal("not the error we expected")
+	}
+	if conn != nil {
+		t.Fatal("expected a nil connection here")
+	}
+}